Jetmonsters
Vulnerability activity for Jetmonsters: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 8
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 9
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.3MediumNov 3, 2026Jetmonsters JetFormBuilder — Dynamic Blocks Form Builder Auth bypass / access controlCVE-2026-120561The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuil
- 6.4MediumOct 10, 2026Jetmonsters Getwid – Gutenberg Blocks XSSCVE-2026-91862The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- 4.7MediumOct 10, 2026Jetmonsters JetFormBuilder — Dynamic Blocks Form Builder XSSCVE-2026-103912The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '<attacker-chosen query var name matching the preset's query_var setting>' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such
- 7.2HighOct 2, 2026Jetmonsters JetFormBuilder — Dynamic Blocks Form Builder XSSCVE-2026-97342The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopri
- 7.1HighSep 30, 2026Jetmonsters JetFormBuilder XSSCVE-2026-102391Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.
- 6.4MediumSep 23, 2026Jetmonsters Getwid – Gutenberg Blocks XSSCVE-2026-5924The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval() on user-controlled block content in the frontend JavaScript mapStyles() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa
- 9.8CriticalSep 16, 2026Jetmonsters JetFormBuilder — Dynamic Blocks Form Builder Privilege escalationCVE-2026-12793The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
- 7.2HighSep 15, 2026Jetmonsters MotoPress Hotel Booking XSSCVE-2026-90650The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The premium Stripe webhook listener only verifies the webhook signature when an optional Stripe signing se
- 8.5HighJun 26, 2026Jetmonsters Restaurant Menu by MotoPress SQL injectionCVE-2026-57644Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.
Top products
- JetFormBuilder — Dynamic Blocks Form Builder4 CVEs in the last year, 1 critical
- Getwid – Gutenberg Blocks2 CVEs in the last year
- Restaurant Menu by MotoPress1 CVE in the last year
- MotoPress Hotel Booking1 CVE in the last year
- JetFormBuilder1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.